aperturedata/aperturedb-compose-single-node:latest

# aperturedb-compose version: 0.20.0

services:

  aperturedb:
    cpus: ${ADB_CPUS:-0}
    mem_limit: ${ADB_MEMORY_LIMIT:-0}
    image: ${APERTUREDB_IMAGE:-${IMAGE_REPOSITORY_PREFIX:-}aperturedata/aperturedb:0.20.0}
    restart: always
    environment:
      ADB_KVGD_DB_SIZE: ${ADB_KVGD_DB_SIZE:-204800}
      ADB_DB_ROOT_PATH: "/aperturedb/db"
      ADB_LOG_PATH: "/aperturedb/logs"
      ADB_PORT: 55553
      ADB_ENABLE_DEBUG: ${ADB_ENABLE_DEBUG:-1}
      ADB_MAX_SIMULTANEOUS_CLIENTS: ${ADB_MAX_SIMULTANEOUS_CLIENTS:-24}
      ADB_FORCE_SSL: false
      ADB_TIMEOUT_RECEIVE: false
      ADB_LOG_LEVEL: ${ADB_LOG_LEVEL:-1}
      ADB_MASTER_KEY: ${ADB_MASTER_KEY:-admin}
    volumes:
      - "${DATA_DIR:+${DATA_DIR:-}/}aperturedb_db:/aperturedb/db"
      - "${DATA_DIR:+${DATA_DIR:-}/}aperturedb_logs:/aperturedb/logs"

  promtail:
    profiles:
      - telemetry
    image: ${PROMTAIL_IMAGE:-${IMAGE_REPOSITORY_PREFIX:-}aperturedata/promtail:0.20.0}
    restart: always
    environment:
      POD_IP: aperturedb
    volumes:
      - "${DATA_DIR:+${DATA_DIR:-}/}aperturedb_logs:/mnt/aperture"

  loki:
    profiles:
      - telemetry
    image: ${LOKI_IMAGE:-${IMAGE_REPOSITORY_PREFIX:-}aperturedata/loki:0.20.0}
    restart: always
    user: 0:0
    environment:
      LOKI_RETENTION_PERIOD: ${LOKI_RETENTION_PERIOD:-672h}
    volumes:
      - "${DATA_DIR:+${DATA_DIR:-}/}loki:/loki"

  prometheus:
    profiles:
      - telemetry
    image: ${PROMETHEUS_IMAGE:-${IMAGE_REPOSITORY_PREFIX:-}aperturedata/prometheus:0.20.0}
    restart: always
    user: 0:0
    command: [ "--config.file=/etc/prometheus/prometheus.yml", "--storage.tsdb.path=/prometheus", "--storage.tsdb.retention.time=${PROMETHEUS_RETENTION_TIME:-28d}" ]
    configs:
      - source: monitoring_password
        target: /etc/prometheus/auth/password
    volumes:
      - "${DATA_DIR:+${DATA_DIR:-}/}prometheus:/prometheus"


  grafana:
    profiles:
      - telemetry
    image: ${GRAFANA_IMAGE:-${IMAGE_REPOSITORY_PREFIX:-}aperturedata/grafana:0.20.0}
    restart: always
    user: 0:0
    environment:
      GF_SERVER_ROOT_URL: ${GF_SERVER_ROOT_URL:-https://localhost:${HTTPS_PORT:-443}/grafana/}
      GF_SECURITY_ADMIN_USER: ${GF_SECURITY_ADMIN_USER:-admin}
      GF_SECURITY_ADMIN_PASSWORD: ${GF_SECURITY_ADMIN_PASSWORD:-admin}
      GF_SERVER_SERVE_FROM_SUB_PATH: 'false'
    volumes:
      - "${DATA_DIR:+${DATA_DIR:-}/}grafana:/var/lib/grafana"


  webui:
    image: ${WEBUI_IMAGE:-${IMAGE_REPOSITORY_PREFIX:-}aperturedata/webui:0.20.0}
    restart: always

  ca:
    image: ${OPENSSL_IMAGE:-${IMAGE_REPOSITORY_PREFIX:-}alpine/openssl:3.5.9}
    restart: on-failure
    environment:
      TLS_CERT_DIR: ${TLS_CERT_DIR:-}
      TLS_CERT_FILENAME: ${TLS_CERT_FILENAME:-tls.crt}
      TLS_KEY_FILENAME: ${TLS_KEY_FILENAME:-tls.key}
      TLS_CERT_HOSTNAMES: ${TLS_CERT_HOSTNAMES:-}
    entrypoint: ["/bin/sh", "-ec"]
    command:
      - |
        case "$$TLS_CERT_FILENAME" in
          ""|.|..|*[!a-zA-Z0-9._-]*)
            echo "TLS_CERT_FILENAME must be a plain filename using letters, digits, dots, underscores or hyphens." >&2
            exit 1 ;;
        esac
        case "$$TLS_KEY_FILENAME" in
          ""|.|..|*[!a-zA-Z0-9._-]*)
            echo "TLS_KEY_FILENAME must be a plain filename using letters, digits, dots, underscores or hyphens." >&2
            exit 1 ;;
        esac
        if [ "$$TLS_CERT_FILENAME" = "$$TLS_KEY_FILENAME" ]; then
          echo "Certificate and private key filenames must differ." >&2
          exit 1
        fi
        certificate="/cert/$$TLS_CERT_FILENAME"
        private_key="/cert/$$TLS_KEY_FILENAME"
        if [ -n "$$TLS_CERT_DIR" ]; then
          if [ -n "$$TLS_CERT_HOSTNAMES" ]; then
            echo "TLS_CERT_HOSTNAMES applies only to the generated certificate; unset it when TLS_CERT_DIR is set." >&2
            exit 1
          fi
          case "$$TLS_CERT_DIR" in
            /*) ;;
            *) echo "TLS_CERT_DIR must be an absolute directory on the Docker host." >&2; exit 1 ;;
          esac
          if [ ! -s "$$certificate" ] || [ ! -s "$$private_key" ]; then
            echo "TLS_CERT_DIR must contain both the supplied certificate and private key; no files will be generated." >&2
            exit 1
          fi
          openssl rsa -in "$$private_key" -passin pass: -check -noout >/dev/null
          certificate_modulus=$$(openssl x509 -in "$$certificate" -noout -modulus)
          private_key_modulus=$$(openssl rsa -in "$$private_key" -passin pass: -noout -modulus)
          if [ "$$certificate_modulus" != "$$private_key_modulus" ]; then
            echo "The supplied certificate and RSA private key do not match." >&2
            exit 1
          fi
          exit 0
        fi
        # The generated certificate is valid for local clients, for clients on
        # the Compose network (lenz, http-proxy) and for TLS_CERT_HOSTNAMES.
        set -f
        names="localhost lenz http-proxy 127.0.0.1 ::1 $$(printf '%s' "$$TLS_CERT_HOSTNAMES" | tr ',' ' ')"
        subject_alt_names=
        seen=" "
        for name in $$names; do
          case "$$seen" in *" $$name "*) continue ;; esac
          seen="$$seen$$name "
          if printf '%s' "$$name" | grep -Eq '^[0-9.]+$$|:'; then
            entry="IP:$$name"
          elif [ $${#name} -le 253 ] && printf '%s' "$$name" | grep -Eq '^([A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?[.])*[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?$$'; then
            entry="DNS:$$name"
          else
            echo "TLS_CERT_HOSTNAMES must list DNS names or IP addresses separated by commas: $$name" >&2
            exit 1
          fi
          subject_alt_names="$${subject_alt_names:+$$subject_alt_names,}$$entry"
        done
        names_file="$$certificate.names"
        if [ -s "$$certificate" ] && [ -s "$$private_key" ]; then
          if [ -f "$$names_file" ] && [ "$$(cat "$$names_file")" = "$$subject_alt_names" ]; then
            exit 0
          fi
          echo "Generating a new certificate for $$subject_alt_names"
        elif [ -e "$$certificate" ] || [ -e "$$private_key" ]; then
          echo "Incomplete certificate pair in /cert; restore both files before starting." >&2
          exit 1
        fi
        umask 077
        if ! openssl req -x509 -newkey rsa:4096 -days 3650 -nodes -keyout "$$private_key.new" -out "$$certificate.new" -subj "/C=US/O=ApertureData Inc./CN=localhost" -addext "subjectAltName=$$subject_alt_names"; then
          echo "Could not generate a certificate for $$subject_alt_names; check TLS_CERT_HOSTNAMES." >&2
          exit 1
        fi
        printf '%s\n' "$$subject_alt_names" > "$$names_file.new"
        mv "$$private_key.new" "$$private_key"
        mv "$$certificate.new" "$$certificate"
        mv "$$names_file.new" "$$names_file"
    volumes:
      - "${TLS_CERT_DIR:-certificate_volume}:/cert${TLS_CERT_DIR:+:ro}"

  http-proxy:
    image: ${HTTP_PROXY_IMAGE:-${IMAGE_REPOSITORY_PREFIX:-}aperturedata/http-proxy:0.20.0}
    restart: always
    depends_on:
      ca:
        condition: service_completed_successfully
    stop_grace_period: 310s
    environment:
      TLS_CERT_FILENAME: ${TLS_CERT_FILENAME:-tls.crt}
      TLS_KEY_FILENAME: ${TLS_KEY_FILENAME:-tls.key}
    ports:
      - "${GATEWAY:-}:${HTTP_PORT:-80}:8081"
      - "${GATEWAY:-}:${HTTPS_PORT:-443}:8443"
    configs:
      - source: http_config
        target: /etc/aperturedb/http/config.json
    volumes:
      - "${TLS_CERT_DIR:-certificate_volume}:/etc/aperturedb/certificate:ro"

  lenz:
    cpus: ${LNZ_CPUS:-0}
    mem_limit: ${LNZ_MEMORY_LIMIT:-0}
    depends_on:
      ca:
        condition: service_completed_successfully
    image: ${LENZ_IMAGE:-${IMAGE_REPOSITORY_PREFIX:-}aperturedata/lenz:0.20.0}
    restart: always
    ports:
      - "${GATEWAY:-}:${ADB_TCP_PORT:-55555}:55551"
    environment:
      LNZ_HEALTH_PORT: 58085
      LNZ_TCP_PORT: 55551
      LNZ_HTTP_PORT: 8080
      LNZ_ADB_BACKENDS: '["aperturedb:55553"]'
      LNZ_REPLICAS: 1
      LNZ_ADB_MAX_CONCURRENCY: ${LNZ_ADB_MAX_CONCURRENCY:-24}
      LNZ_FORCE_SSL: ${LNZ_FORCE_SSL:-false}
      LNZ_CERTIFICATE_PATH: /etc/lenz/certificate/${TLS_CERT_FILENAME:-tls.crt}
      LNZ_PRIVATE_KEY_PATH: /etc/lenz/certificate/${TLS_KEY_FILENAME:-tls.key}
      LNZ_METRICS_PATH: /etc/lenz/metrics
      LNZ_DB_PATH: /etc/lenz/db
    configs:
      - source: monitoring_password
        target: /etc/lenz/metrics/password
      - source: telemetry_db_password
        target: /etc/lenz/db/password
    volumes:
      - "${TLS_CERT_DIR:-certificate_volume}:/etc/lenz/certificate:ro"

configs:
  http_config:
    content: |
      {"tls":true,"https_port":${HTTPS_PORT:-443},"webui_host":"webui","grafana_host":"grafana","body_limit":${HTTP_BODY_LIMIT:-268435456},"timeout_seconds":${HTTP_TIMEOUT_SECONDS:-300}}

  # Bearer password shared by Prometheus and Lenz for /api/servers and
  # /api/metrics; set MONITORING_PASSWORD.
  monitoring_password:
    content: ${MONITORING_PASSWORD:-monitoring}

  # Lenz collects metrics as the _telemetry database user, which authenticates
  # with the master key; set ADB_MASTER_KEY.
  telemetry_db_password:
    content: ${ADB_MASTER_KEY:-admin}

volumes:
  certificate_volume:
  aperturedb_db:
  aperturedb_logs:
  grafana:
  loki:
  prometheus: